fix(ci): 为集成测试提供固定 Docker CLI

从固定 digest 的 Runner 镜像提取 Docker CLI 29.6.0，校验二进制 SHA-256 后通过只读工具链挂载给 Job。

同步 PR 与 Tag 工作流的版本探针，并增加流水线契约测试，避免 PostgreSQL 集成测试再次因缺少 docker 命令失败。

scripts/provision-ci-runner.sh

@@ -26,6 +26,8 @@ SHELLCHECK_VERSION=0.11.0
 SHELLCHECK_SHA256=8c3be12b05d5c177a04c29e3c78ce89ac86f1595681cab149b65b97c4e227198
 COMPOSE_VERSION=5.3.1
 COMPOSE_SHA256=f9ebc6ebdb19d769b793c245a736caaeb198c62587f13b25c660c13b4987f959
+DOCKER_CLI_VERSION=29.6.0
+DOCKER_CLI_SHA256=80b40fa11d797a71ea15f9a31e7004790ddac95f58a8222a40c08f08a639faba
 PNPM_VERSION=10.18.1
 RUNNER_IMAGE='docker.io/gitea/runner:2.0.0-dind-rootless@sha256:5b7b625ff773d0ee761788c47582503ec1b241fa5b81edebad48a57e663f4f3a'
 JOB_IMAGE='docker.io/library/node:24.16.0-bookworm@sha256:40ad9f3064e67d6860b4bc3fe1880b2953934fd6320ada990e45fe0efa6badd7'
@@ -188,14 +190,25 @@ tar -xzf "$PREFIX/downloads/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" -C "$PREF
 chmod 0755 "$PREFIX/bin/trivy"
 GOBIN="$PREFIX/bin" GOPROXY="${GO_MODULE_PROXY:-https://goproxy.cn,direct}" \
   "$PREFIX/toolchains/go/bin/go" install golang.org/x/vuln/cmd/govulncheck@v1.6.0
-chown -R root:root "$PREFIX"
-chmod -R go-w "$PREFIX"
 
 require_free_space "$MIN_FREE_GIB" "runner image pull"
 docker pull "$RUNNER_IMAGE_SOURCE"
 runner_runtime_image=$(docker image inspect --format '{{.Id}}' "$RUNNER_IMAGE_SOURCE")
 printf '%s\n' "$runner_runtime_image" | grep -Eq '^sha256:[0-9a-f]{64}$' || \
   fail "pinned runner image did not resolve to an immutable local image ID"
+
+# The job image intentionally contains no Docker client. Extract the static CLI
+# from the immutable Runner image, then verify its binary digest before exposing
+# it through the read-only CI toolchain mount.
+docker_cli_download="$PREFIX/downloads/docker-${DOCKER_CLI_VERSION}-linux-x86_64"
+docker run --rm --pull=never --entrypoint /bin/cat "$runner_runtime_image" \
+  /usr/local/bin/docker > "$docker_cli_download"
+printf '%s  %s\n' "$DOCKER_CLI_SHA256" "$docker_cli_download" | sha256sum -c -
+install -m 0755 "$docker_cli_download" "$PREFIX/bin/docker"
+"$PREFIX/bin/docker" --version | grep -Fq "Docker version ${DOCKER_CLI_VERSION},"
+chown -R root:root "$PREFIX"
+chmod -R go-w "$PREFIX"
+
 require_free_space "$MIN_POST_INSTALL_FREE_GIB" "completed runner image pull"
 docker volume create "$RUNNER_VOLUME" >/dev/null
 
@@ -298,6 +311,7 @@ docker exec "$PROBE_CONTAINER" docker run --rm --pull=never \
     go version
     node --version
     pnpm --version
+    docker --version
     docker-compose version
     shellcheck --version
     trivy --version